Most consequential journeys rarely announce themselves as such . While a truth I have seen reflected in some of the “deeper” things of life, on occasion the same reflections play out professionally as well.

I have been through a SOC 2 certification before and like most journeys taken in a hurry, the first time I was focused almost entirely on arrival. Policies were written. Evidence was collected. Controls were documented. The report was issued. We reached the destination on schedule and then, as organizations often do, we largely returned to where we had started.

It was only in reflection that I recognized what had been missed. Not the certification. We had acquired the certification. What was missing was everything the road might have offered had we been paying attention to it.

THE ROAD HAS A WAY OF REVEALING THINGS

There is a reason experienced travelers will tell you that the most valuable moments rarely happen at the landmark itself. They happen in transit, in the conversations that surface unexpectedly, in the detours that turn out to matter, in the discomfort that quietly reshapes how you see things.

Compliance programs work the same way .

SOC 2, at its surface, is a framework with defined Trust Service Criteria, audit requirements, and a report that either issues or does not. Those things are real and they matter. But the framework's most significant value is not in the destination it produces. It is in what the journey forces an organization to confront about itself.

Who actually owns this process? Does anyone know? Has this procedure ever been written down, or does it exist entirely in one person's institutional memory? What would happen to this control if that person left tomorrow?

These are not audit questions. They are organizational health questions. SOC 2 simply insists they be answered honestly.

WHAT I FOUND AT GoSB

When I joined GoSB and we began our SOC 2 journey, I arrived expecting the familiar pattern. What I found instead reframed how I think about these programs entirely.

The organization did not need to be persuaded to take the journey seriously. Team members wanted clearer ownership. Leaders wanted governance they could depend on as the company scaled. Departments wanted processes that lived in documentation rather than in memory. The appetite for that kind of rigor was already present. The organization simply needed a structured path to walk it out.

What struck me most was not any single milestone we reached. It was what surfaced along the way. Conversations about accountability that had never quite happened before. Decisions about ownership that had been deferred and were now being made. Processes being written down for the first time, not because an auditor required it, but because people understood, often for the first time, why it mattered.

Certification did not impose discipline on our team. It gave the organization's existing discipline a route to travel and a way to demonstrate when it had arrived.

THE MIRROR IN THE MIDDLE OF THE ROAD

SOC 2 is, in practice, a mirror. And mirrors are most useful not when they confirm what you hoped to see, but when they show you something you did not expect.

Organizations that approach the program as a checklist tend to see exactly that reflected back. Completed tasks, satisfied criteria, a report filed and forgotten. Organizations that approach it as a journey tend to discover something more durable. Gaps in accountability they did not know existed, governance habits worth building on, and operating foundations strong enough to support what comes next.

The difference is rarely about the framework. It is about the posture the organization brings to the road.

That posture shows up early and consistently. It shows up in whether the conversations center on what is required or what is right. It shows up in whether documentation is treated as an artifact produced for an auditor or as institutional knowledge built for the organization. It shows up in whether the program ends at the report or continues as a way of operating.

WHAT THE JOURNEY BUILT

We accomplished something genuinely impressive, not because we completed an audit, but because of what we built while pursuing it. 

Ownership became clearer. Decision-making became more defensible. Processes that had lived in people's heads became documented, reviewable, and improvable. The organization developed the habits that customers, partners, and investors expect from a company they are choosing to trust with their business.

That point is worth staying with. Trust is the underlying currency of SOC 2. The report is not the asset. The report is evidence of the asset. The asset is an organization that has demonstrated it can govern itself with consistency, transparency, and integrity, not once for an auditor, but as a matter of how it operates.

A NOTE FOR FELLOW TRAVELERS

As technology leaders, we invest heavily in systems, architecture, and tooling. Those investments are necessary. But scaling organizations eventually encounter constraints that no platform resolves and no infrastructure upgrade addresses.

Process breaks down. Governance lags behind growth. Accountability becomes diffuse precisely when it needs to be sharpest. Consistency erodes as complexity compounds.

Frameworks like SOC 2 are most valuable at exactly this moment, when speed feels more urgent than discipline, and when the temptation to bypass rigor in favor of momentum is strongest. The organizations that resist that temptation tend to emerge from the journey with something the destination alone could never provide. The operating habits required to scale with confidence and the institutional trust required to earn the right to do so.

I am proud of what we achieved. The certification is a meaningful milestone, and it signals clearly to the market that we take our obligations to customers and partners seriously. But what I will carry forward is not the report. It is the reminder that the most important things an organization learns about itself are rarely found at the finish line. They are found along the way, in the questions the journey insists you answer, and in the discipline it builds in the answering.

The destination confirms where you are, but the journey determines who you become.

Until the next dispatch, Dearest Gentle Readers, may your audits be ever in your favor.

‍

=================================================================================

‍

‍Larrian Martin is the Chief Information Officer at GoSB, a specialty healthcare RCM company. He was formerly Senior Vice President at Envision Healthcare and holds an Engineering Science degree from Penn State University where he studied in the Artificial Hearts Lab.

‍